Binary Fingerprinting for Native Library Vulnerability Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge lies in tracking and managing native binaries used in software applications, particularly due to the large number of libraries and binaries, which makes it difficult to identify and address vulnerabilities in native binaries.
Innovation Solution
The method involves disassembling a reference binary to generate a control flow graph, normalizing it, traversing it to create execution traces, and processing these traces using a vector embedding model to generate library vector embeddings. These embeddings are then used to create a fingerprint of the library, allowing for the detection of native binaries within target software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If native binaries are used to improve performance, then execution speed is improved, but vulnerability tracking difficulty increases
Solution Approach 1:
The patent creates a fingerprint copy of the native binary by extracting control flow graph characteristics and converting them to a normalized representation. This fingerprint serves as a detectable identifier that can be matched against known vulnerable binaries, enabling vulnerability tracking without changing the original binary's execution performance.
Solution Approach 2:
The patent replaces manual vulnerability tracking methods with an automated system that uses control flow graph analysis and fingerprint matching. The system automatically extracts execution traces, generates fingerprints, and compares them against vulnerability databases, substituting human effort with computational processes.
2Adaptability or versatility
If multiple libraries and native binaries are integrated into software projects, then functionality is improved, but tracking and managing vulnerabilities becomes more difficult
Solution Approach 1:
The patent segments the complex task of vulnerability management into distinct components: binary disassembly, control flow graph extraction, fingerprint generation, and matching. By breaking down the problem into these manageable segments, the system can handle multiple libraries and binaries systematically without overwhelming complexity.
Solution Approach 2:
The patent creates a universal fingerprinting system that can identify native binaries across different libraries and software projects. The control flow graph-based fingerprint is a universal representation that works regardless of the specific library or binary source, enabling centralized vulnerability management for diverse software components.
3Measurement precision
If control flow graph analysis is performed on native binaries, then detection accuracy is improved, but processing complexity increases
Solution Approach 1:
The patent extracts only the essential characteristics needed for identification from the control flow graph, such as execution trace patterns and structural features. By taking out only the necessary information rather than analyzing the entire binary, the system achieves high detection accuracy while managing processing complexity.
Solution Approach 2:
The patent transforms the control flow graph into a normalized fingerprint representation, changing the parameters from raw binary instructions to abstracted structural characteristics. This parameter transformation simplifies the data while preserving the unique identification features, improving detectability without requiring complex processing of the original binary format.
Data Source
AI summary
A method includes disassembling a reference binary of a library to generate a control flow graph of the referenced binary, normalizing the control flow graph to generate a normalized graph, traversing the normalized graph to generate execution traces from the normalized graph, and generating library vector embeddings. Generating library vector embeddings includes, for each execution trace of at least a subset of the execution traces, processing the execution trace by a vector embedding model to generate a library vector embedding of the execution trace. The method further includes relating, in storage, a library identifier of the library to the plurality of library vector embeddings as a fingerprint of the library.